Two-factor authentication is commonly used to increase the confidence in a user's identity and augment existing authentication factors such as passwords. While a password or other knowledge-based factor (“what you know”) can be captured, phished, and replayed by a malicious party, an authentication factor that requires possession of a unique device (“what you have”) can provide greater security. These “what you have” authentication factors commonly take the form of a hardware token (e.g., RSA's infamous SecurID product line) that generates one-time passcodes. These one-time passcodes are commonly 6 digit numeric passcodes generated using an algorithm and a stored secret key. While these hardware devices offer a strong second factor of authentication when deployed alongside traditional knowledge-based passwords, the devices are expensive, difficult to manage, and painful for end users having to carry around an extra device at all times. As mobile devices become increasingly ubiquitous, powerful, and extensible to run third-party applications, they present an attractive replacement for hardware tokens. Instead of carrying around an expensive hardware token to generate one-time passwords, a user can simply use an application on their phone to generate the same one-time passwords. However, this increase in usability, convenience, and management comes at the cost of ensuring the integrity and security of the mobile application and mobile device software. While a dedicated hardware token can be tamper-resistant, have a small trusted computing base, and accept limited outside input, a mobile device is a rich software environment that often suffers vulnerabilities and other security weaknesses that plague any non-trivial software system. Therefore, if a mobile device is used in place of a hardware token for authentication, it is imperative that the device's storage, applications, and platform remain in a secure state and are not compromised by attackers or malicious applications that may reside on the same device. Unfortunately, such attacks against mobile devices do take place and the threat of mobile malware and other types of mobile attacks will only increase in the future as they evolve into more attractive targets to compromise. Therefore, organizations that wish to use mobile devices as a form of authentication (whether OTP-based or otherwise) have a difficult trade-off to evaluate between the increased security/isolation but decreased usability of a dedicated hardware device, and the increased usability but decreased security/isolation of a mobile device. Thus, there is a need in the authentication field to create a new and useful system and method enforcing a policy for an authenticator device. This invention provides such a new and useful system and method.